{"id":"CVE-2026-74656","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fix use-after-free in fib_nhc_update_mtu()\n\nfib_nhc_update_mtu() walks the nexthop exception table under RTNL, but\nRTNL does not serialize this walk with PMTU exc…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fix use-after-free in fib_nhc_update_mtu()\n\nfib_nhc_update_mtu() walks the nexthop exception table under RTNL, but\nRTNL does not serialize this walk with PMTU exc…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 < fd39e711866498ae94fcf9acf6f422a4f045b681","Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 < e1e602d6b22d5cb1641c4459c487eb18bf569e0a","Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 < e00f7d2b5f2540a3415a229c982af7a25ff6362e","Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 < dfe388da13aa784851e5ebbea90afbb099075761","Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 < 5a28a4b22dde92f9d293b94236314b8d6181dc4a","Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 < 63996ffc594d128ccec8fc0983f91effd2d3adc4","Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 < ed503eaad62f20cdd5122d7c3078a648a99c8f16","Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 < bc5bde9ce3cc36502839dfe98e068f7303a50982","Linux b427832009b97a3ee412ef643a80b15372a7754d","Linux 2b7e4c735933be79882aba2bed9afa789e03c62f","Linux 8d59c3a6376bbc6dd3f7303968a719ffba75a4f1","Linux 9b4869cf385aa16f89c0f019eed4ec4e36aa441c","Linux ff34695ced21e2dfa04d0fa1c5f6c35011fa8117","Linux >= 3.16.62 < 3.17","Linux >= 4.4.162 < 4.5","Linux >= 4.9.134 < 4.10","Linux >= 4.14.77 < 4.15","Linux >= 4.18.15 < 4.19","Linux 4.19"],"published":"2026-08-22","updated":"2026-10-16","sourceUpdated":"2026-10-16T20:17:49.840","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74656","references":[{"url":"https://git.kernel.org/stable/c/5a28a4b22dde92f9d293b94236314b8d6181dc4a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63996ffc594d128ccec8fc0983f91effd2d3adc4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc5bde9ce3cc36502839dfe98e068f7303a50982","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dfe388da13aa784851e5ebbea90afbb099075761","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e00f7d2b5f2540a3415a229c982af7a25ff6362e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e1e602d6b22d5cb1641c4459c487eb18bf569e0a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed503eaad62f20cdd5122d7c3078a648a99c8f16","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd39e711866498ae94fcf9acf6f422a4f045b681","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.00126,"epssPercentile":0.02236,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:13:56.950831Z"},"ingestedAt":"2026-10-14T13:30:58.528Z","slug":"CVE-2026-74656","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fix use-after-free in fib_nhc_update_mtu()\n\nfib_nhc_update_mtu() walks the nexthop exception table under RTNL, but\nRTNL does not serialize this walk with PMTU exception updates. The walk\nuses rcu_dereference_protected() with a constant true condition without\nholding fnhe_lock.\n\nThe following interleaving can therefore occur:\n\n  CPU 0                              CPU 1\n  fib_nhc_update_mtu()               update_or_create_fnhe()\n    load fnhe                          spin_lock_bh(&fnhe_lock)\n                                       fnhe_remove_oldest()\n                                         unlink fnhe\n                                         kfree_rcu(fnhe, rcu)\n    <quiescent state>\n    access fnhe after grace period\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410\n  Read of size 8 at addr ffff888107d49000 by task poc/90\n  Call Trace:\n   fib_nhc_update_mtu+0x3df/0x410\n   fib_sync_mtu+0x7a/0xd0\n   fib_netdev_event+0x229/0x3f0\n   netif_set_mtu_ext+0x33a/0x570\n   dev_set_mtu+0x88/0x120\n\nThe same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a\npair and other writers serialize them with fnhe_lock. RCU alone prevents\nreclamation, but would still allow concurrent writers to leave a mixed\npair.\n\nWalk the table under RCU and acquire fnhe_lock only while updating each\nexception. RCU keeps the current entry alive while the short critical\nsection serializes its paired PMTU fields. This avoids holding the global\nlock while scanning all 2048 buckets for every nexthop.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}